https://vertho.tech/Recent content on VerthoHugoen-usTue, 06 Oct 2026 09:10:46 +0000https://vertho.tech/2026/10/06/top3-blog-posts-about-microsoft-isoc/Tue, 06 Oct 2026 09:10:46 +0000https://vertho.tech/2026/10/06/top3-blog-posts-about-microsoft-isoc/The 3 blogs that helped me most to understand the new Integrated Security Operations Center (ISOC) in Microsoft Defender.https://vertho.tech/2026/08/13/defedner-for-endpoint-controlled-configuration-tamper-protection-on-steroids-a-deep-dive/Thu, 13 Aug 2026 09:14:29 +0100https://vertho.tech/2026/08/13/defedner-for-endpoint-controlled-configuration-tamper-protection-on-steroids-a-deep-dive/A deep dive into controlled configuration in Defender for Endpoint: what it enforces, how it relates to Tamper Protection and how it behaves on a device.https://vertho.tech/2026/03/23/microsoft-defender-unified-role-based-access-mapper/Mon, 23 Mar 2026 16:29:13 +0100https://vertho.tech/2026/03/23/microsoft-defender-unified-role-based-access-mapper/Retired: an interactive web tool that mapped Microsoft Defender Unified RBAC permissions to capabilities and workloads, to help find the permission you need.https://vertho.tech/2026/03/22/defender-unified-role-based-access-control-rbac-support-for-microsoft-sentinel-is-here-tool-urbac-mapper/Sun, 22 Mar 2026 11:31:04 +0100https://vertho.tech/2026/03/22/defender-unified-role-based-access-control-rbac-support-for-microsoft-sentinel-is-here-tool-urbac-mapper/Defender Unified RBAC now supports Microsoft Sentinel, so Azure permissions are no longer needed for workspace data in the Defender portal. Limitations and tips.https://vertho.tech/2026/02/11/identity-threat-detection-and-response-linking-accounts/Wed, 11 Feb 2026 11:53:18 +0100https://vertho.tech/2026/02/11/identity-threat-detection-and-response-linking-accounts/How to link the scattered accounts of one person into a single identity in Defender for Identity, manually or with custom correlation rules.https://vertho.tech/2026/01/28/defender-for-endpoint-migration-troubleshooting-persistent-third-party-av-registration/Wed, 28 Jan 2026 22:59:34 +0100https://vertho.tech/2026/01/28/defender-for-endpoint-migration-troubleshooting-persistent-third-party-av-registration/A third-party antivirus stays registered in Windows after uninstalling it and keeps Defender in a disabled state. How we found and removed the leftover registration.https://vertho.tech/2025/12/01/mdi-configurator-v1-0-is-out/Mon, 01 Dec 2025 15:29:41 +0100https://vertho.tech/2025/12/01/mdi-configurator-v1-0-is-out/MDI-configurator v1.0: a free PowerShell GUI to configure, test and report on Microsoft Defender for Identity without remembering the commands.https://vertho.tech/2025/10/22/remotely-intune-wipe-devices-in-defender-for-endpoint-isolation-mode/Wed, 22 Oct 2025 15:12:10 +0100https://vertho.tech/2025/10/22/remotely-intune-wipe-devices-in-defender-for-endpoint-isolation-mode/Using the new isolation exclusions in Defender for Endpoint to remotely wipe a device with Intune while it stays in isolation mode.https://vertho.tech/2025/09/29/the-ultimate-defender-xdr-rbac-visualization/Mon, 29 Sep 2025 19:51:14 +0100https://vertho.tech/2025/09/29/the-ultimate-defender-xdr-rbac-visualization/A visual overview of the Microsoft Defender XDR Unified RBAC roles and permissions, to help you design your role model.https://vertho.tech/2025/08/27/guidance-on-how-to-manage-products-updates-for-defender-for-server-on-linux-distributions/Wed, 27 Aug 2025 08:43:50 +0100https://vertho.tech/2025/08/27/guidance-on-how-to-manage-products-updates-for-defender-for-server-on-linux-distributions/How to manage Defender for Endpoint product updates on Linux servers: package managers, update rings and the approach I recommend to customers.https://vertho.tech/2025/06/23/defender-av-mystery-solving-the-source-files-could-not-be-found/Mon, 23 Jun 2025 19:39:17 +0100https://vertho.tech/2025/06/23/defender-av-mystery-solving-the-source-files-could-not-be-found/Enabling the Defender Antivirus role on a Windows Server fails with "source files could not be found". Why this happens and how to solve it.https://vertho.tech/2025/06/07/mde-troubleshooter-v1-6-1-available/Sat, 07 Jun 2025 07:58:59 +0100https://vertho.tech/2025/06/07/mde-troubleshooter-v1-6-1-available/MDE-Troubleshooter v1.6.1 adds more Performance Analyzer options, new ASR rules and checks for Device Control, proxy settings and outdated signatures.https://vertho.tech/2025/05/07/defender-for-office-365-visualisation-of-the-tenant-allow-block-list-features/Wed, 07 May 2025 10:45:49 +0100https://vertho.tech/2025/05/07/defender-for-office-365-visualisation-of-the-tenant-allow-block-list-features/A visual overview of the Tenant Allow/Block List in Defender for Office 365: which entries exist and how each one affects mail flow.https://vertho.tech/2025/04/14/using-azure-arc-only-for-defender-for-servers-or-azure-monitoring-agent-lock-it-down/Mon, 14 Apr 2025 11:09:13 +0100https://vertho.tech/2025/04/14/using-azure-arc-only-for-defender-for-servers-or-azure-monitoring-agent-lock-it-down/If you only use Azure Arc for Defender for Servers or the Azure Monitoring Agent, disable the features you do not need. The security risks and how to lock it down.https://vertho.tech/2025/03/25/proactive-exposure-hunting-oauth-applications-and-azure-permissions/Tue, 25 Mar 2025 14:17:56 +0100https://vertho.tech/2025/03/25/proactive-exposure-hunting-oauth-applications-and-azure-permissions/KQL hunting queries for the Exposure Management tables that reveal risky OAuth applications and their Azure permissions before an attacker finds them.https://vertho.tech/2025/02/19/unleash-the-power-of-enterprise-exposure-graph-managed-identities-permissions-overview/Wed, 19 Feb 2025 16:57:07 +0100https://vertho.tech/2025/02/19/unleash-the-power-of-enterprise-exposure-graph-managed-identities-permissions-overview/Use the Enterprise Exposure Graph in Microsoft Exposure Management to build an overview of all managed identities and their Azure permissions with KQL.https://vertho.tech/2025/02/04/tutorial-the-fastest-way-to-report-a-false-negative-in-defender-for-endpoint/Tue, 04 Feb 2025 10:02:44 +0100https://vertho.tech/2025/02/04/tutorial-the-fastest-way-to-report-a-false-negative-in-defender-for-endpoint/The quickest route to report a false negative in Defender for Endpoint to Microsoft, based on a real case that was resolved in four days.https://vertho.tech/2025/01/07/after-2-years-a-new-release-of-mde-troubleshooter/Tue, 07 Jan 2025 14:57:43 +0100https://vertho.tech/2025/01/07/after-2-years-a-new-release-of-mde-troubleshooter/MDE-Troubleshooter gets its first update in two years: new ASR rules, file hash computation check, Client Analyzer download and signature updates.https://vertho.tech/2025/01/03/new-ebook-demystifying-microsoft-defender-for-servers-by-james-agombar/Fri, 03 Jan 2025 15:07:30 +0100https://vertho.tech/2025/01/03/new-ebook-demystifying-microsoft-defender-for-servers-by-james-agombar/A new eBook by James Agombar covers the architecture, licensing, features and deployment of Defender for Servers. I was one of the technical reviewers.https://vertho.tech/2024/11/27/fix-sense-service-stuck-in-start_pending-on-ws2012r2-or-ws2016-check-oobe/Wed, 27 Nov 2024 14:57:16 +0100https://vertho.tech/2024/11/27/fix-sense-service-stuck-in-start_pending-on-ws2012r2-or-ws2016-check-oobe/The SENSE service stays in START_PENDING after onboarding Windows Server 2012 R2 or 2016 to Defender for Endpoint. The cause is OOBE, and here is the fix.https://vertho.tech/2024/03/06/tutorial-how-to-enable-disable-defender-for-servers-plans-at-resources-level/Wed, 06 Mar 2024 10:47:14 +0100https://vertho.tech/2024/03/06/tutorial-how-to-enable-disable-defender-for-servers-plans-at-resources-level/Tutorial: enable or disable Defender for Servers plans on individual resources instead of the whole subscription, using the REST API.https://vertho.tech/2023/08/28/defender-for-endpoint-for-linux-new-capabilities-and-enhancements/Mon, 28 Aug 2023 12:05:10 +0100https://vertho.tech/2023/08/28/defender-for-endpoint-for-linux-new-capabilities-and-enhancements/The new capabilities of Defender for Endpoint on Linux explained: the eBPF-based sensor, performance improvements and how to benefit from them.https://vertho.tech/2023/08/04/microsoft-defender-for-endpoint-security-management-mde-attach-v2-on-linux-a-deep-dive/Fri, 04 Aug 2023 12:51:51 +0100https://vertho.tech/2023/08/04/microsoft-defender-for-endpoint-security-management-mde-attach-v2-on-linux-a-deep-dive/A deep dive into how Defender for Endpoint security settings management (MDE Attach v2) enrolls and applies policy on Linux, step by step.https://vertho.tech/2023/07/20/unleash-the-power-of-defender-plan-2-just-in-time-vm-access-part-4/Thu, 20 Jul 2023 12:29:20 +0100https://vertho.tech/2023/07/20/unleash-the-power-of-defender-plan-2-just-in-time-vm-access-part-4/How just-in-time VM access in Defender for Servers Plan 2 protects management ports such as RDP and SSH, and how to configure it. Part 4 of the series.https://vertho.tech/2023/06/30/tool-mde-troubleshooter-is-born/Fri, 30 Jun 2023 10:00:00 +0100https://vertho.tech/2023/06/30/tool-mde-troubleshooter-is-born/Introducing MDE-Troubleshooter: a free PowerShell GUI that shows the Defender for Endpoint configuration, logs and exclusions of a device in one place.https://vertho.tech/2023/06/23/your-isolated-device-stuck-in-defender-for-endpoint-isolation-mode-not-anymore/Fri, 23 Jun 2023 21:23:01 +0100https://vertho.tech/2023/06/23/your-isolated-device-stuck-in-defender-for-endpoint-isolation-mode-not-anymore/A device that stays in Defender for Endpoint isolation after you release it: why it happens and how to get the device out of isolation mode.https://vertho.tech/2023/06/15/microsoft-defender-for-endpoint-settings-management-enhancements/Thu, 15 Jun 2023 10:54:47 +0100https://vertho.tech/2023/06/15/microsoft-defender-for-endpoint-settings-management-enhancements/What changed in Defender for Endpoint security settings management (MDE Attach): simpler requirements, the new enrollment flow and system labels.https://vertho.tech/2023/06/14/unleash-the-power-of-defender-for-servers-plan-2-agentless-scanning-part-3/Wed, 14 Jun 2023 13:53:39 +0100https://vertho.tech/2023/06/14/unleash-the-power-of-defender-for-servers-plan-2-agentless-scanning-part-3/What agentless scanning in Defender for Servers Plan 2 is, how it works behind the scenes and how to enable it. Part 3 of the series.https://vertho.tech/2023/06/05/direct-on-board-your-non-azure-servers-to-defender-for-cloud-without-azure-arc/Mon, 05 Jun 2023 19:46:44 +0100https://vertho.tech/2023/06/05/direct-on-board-your-non-azure-servers-to-defender-for-cloud-without-azure-arc/How to onboard non-Azure servers to Defender for Servers directly through the Defender for Endpoint agent, without deploying Azure Arc.https://vertho.tech/2023/05/17/advanced-protection-features-in-defender-for-servers-plan-2-adaptive-application-controls-part-2/Wed, 17 May 2023 15:50:15 +0100https://vertho.tech/2023/05/17/advanced-protection-features-in-defender-for-servers-plan-2-adaptive-application-controls-part-2/What adaptive application controls in Defender for Servers Plan 2 are and how to configure them, from prerequisites to alerts. Part 2 of the series.https://vertho.tech/2023/05/04/how-to-work-around-the-azure-security-agent-extension-not-deploying-by-default-on-the-latest-vm-windows-images-a-currently-know-limitation/Thu, 04 May 2023 09:39:19 +0100https://vertho.tech/2023/05/04/how-to-work-around-the-azure-security-agent-extension-not-deploying-by-default-on-the-latest-vm-windows-images-a-currently-know-limitation/The Azure Security Agent extension is not deployed by default on the latest Windows VM images. Why that happens and how to work around it with Azure Policy.https://vertho.tech/2023/04/19/advanced-protection-features-in-defender-for-servers-plan-2-file-integrity-monitoring-part-1/Wed, 19 Apr 2023 14:40:38 +0100https://vertho.tech/2023/04/19/advanced-protection-features-in-defender-for-servers-plan-2-file-integrity-monitoring-part-1/How File Integrity Monitoring (FIM) in Defender for Servers Plan 2 works, how to set it up and how to detect changes. Part 1 of the series.https://vertho.tech/2023/04/07/advanced-protection-features-in-defender-for-servers-plan-2-the-intro-part-0/Fri, 07 Apr 2023 10:18:57 +0100https://vertho.tech/2023/04/07/advanced-protection-features-in-defender-for-servers-plan-2-the-intro-part-0/Start of a series on the advanced protection features in Defender for Servers Plan 2: what is included, and what to watch out for when deploying them.https://vertho.tech/2023/03/27/tutorial-change-the-workspace-destination-of-you-data-collection-rule/Mon, 27 Mar 2023 18:45:40 +0100https://vertho.tech/2023/03/27/tutorial-change-the-workspace-destination-of-you-data-collection-rule/Step-by-step tutorial to point an existing Data Collection Rule of the Azure Monitoring Agent to a different Log Analytics workspace.https://vertho.tech/2023/02/01/block-the-automated-onboarding-of-defender-for-endpoint-without-disabling-the-integration-in-defender-for-cloud/Wed, 01 Feb 2023 12:30:00 +0100https://vertho.tech/2023/02/01/block-the-automated-onboarding-of-defender-for-endpoint-without-disabling-the-integration-in-defender-for-cloud/How to stop Defender for Cloud from automatically onboarding servers to Defender for Endpoint while keeping the integration enabled. Originally published on Medium.https://vertho.tech/2022/07/27/defender-for-servers-mde-onboarding-behind-the-scenes/Wed, 27 Jul 2022 14:13:00 +0100https://vertho.tech/2022/07/27/defender-for-servers-mde-onboarding-behind-the-scenes/What happens behind the scenes when Defender for Servers onboards a machine to Defender for Endpoint. Originally published on Medium.https://vertho.tech/about/Mon, 01 Jan 0001 00:00:00 +0000https://vertho.tech/about/Thomas Verheyden – Security Architect based in Belgium.https://vertho.tech/contact/Mon, 01 Jan 0001 00:00:00 +0000https://vertho.tech/contact/Get in touch about Microsoft Security, speaking requests or anything else.https://vertho.tech/events/Mon, 01 Jan 0001 00:00:00 +0000https://vertho.tech/events/Conferences and user groups where I have spoken about Microsoft Security.https://vertho.tech/tools/Mon, 01 Jan 0001 00:00:00 +0000https://vertho.tech/tools/Free PowerShell tools I built for Microsoft Defender and Intune admins.